{"id":"RUSTSEC-2026-0189","revision":"1978c23e8a5c498bb508f8b9cb2ca71e","records":[{"revision":"1978c23e8a5c498bb508f8b9cb2ca71e","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0189","aliases":["CVE-2026-42559","GHSA-89vp-x53w-74fx","GHSA-fvh2-gm75-j4j7","RUSTSEC-2026-0140"],"title":"DNS rebinding vulnerability in rmcp Streamable HTTP server transport","description":"Prior to version 1.4.0, the `rmcp` crate's Streamable HTTP server transport did\nnot validate the incoming `Host` header.\n\nThis allowed a malicious public website, via a DNS rebinding attack, to send\nrequests to an MCP server running on the victim's loopback or private-network\ninterface.\n\nAn attacker who convinced a victim to visit a malicious page could enumerate and\ninvoke tools exposed by a locally running rmcp-based MCP server, read resources\nand prompts, and trigger side effects limited by the tools exposed by that\nserver.\n\nNon-HTTP transports such as stdio and child-process transports are not affected.\n\n## Patches\n\nThe issue was fixed in `rmcp` 1.4.0 by adding default loopback-only host\nallowlist validation for the Streamable HTTP server transport. Incoming HTTP\nrequests now validate the `Host` header and return HTTP 403 when the host is not\nallowed.\n\nUsers should upgrade to `rmcp >= 1.4.0`.\n\n## Workarounds\n\nIf upgrading is not possible, place the MCP server behind a reverse proxy\nconfigured to reject requests whose `Host` header is not one of the expected\nhostnames. Do not bind the MCP server to `0.0.0.0` without such validation.","state":0,"publishedAt":"2026-04-29T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:14.8044124+00:00","affected":[{"ecosystem":"crates.io","name":"rmcp","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"1.4.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/rmcp","https://rustsec.org/advisories/RUSTSEC-2026-0189.html","https://github.com/modelcontextprotocol/rust-sdk/issues/815","https://github.com/modelcontextprotocol/rust-sdk/pull/764","https://github.com/modelcontextprotocol/rust-sdk/issues/822","https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0189","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0189","identifiers":["RUSTSEC-2026-0189","CVE-2026-42559","GHSA-89vp-x53w-74fx","GHSA-fvh2-gm75-j4j7","RUSTSEC-2026-0140"]},"retained":false,"historicalAffected":[]}],"coverage":[]}